From 0f2e4ea1787c222dff06388301ee80d333891e79 Mon Sep 17 00:00:00 2001 From: Timothy Jaeryang Baek Date: Fri, 13 Mar 2026 16:43:58 -0500 Subject: [PATCH] security: add upgrade hooks for security patching - Alpine: apk upgrade active (Alpine patches ship fast) - Slim/default: apt-get upgrade commented out with guidance --- Dockerfile | 4 ++++ Dockerfile.alpine | 3 +++ Dockerfile.slim | 4 ++++ 3 files changed, 11 insertions(+) diff --git a/Dockerfile b/Dockerfile index 4697738..9440e9b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -39,6 +39,10 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ # Docker CLI + Compose + Buildx (mount socket at runtime for access) RUN curl -fsSL https://get.docker.com | sh +# Uncomment to apply security patches beyond what the base image provides. +# Not recommended for reproducible builds; prefer bumping the base image tag. +# RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/* + WORKDIR /app diff --git a/Dockerfile.alpine b/Dockerfile.alpine index 502ce50..9326cbc 100644 --- a/Dockerfile.alpine +++ b/Dockerfile.alpine @@ -94,6 +94,9 @@ COPY --from=builder /install /usr/local WORKDIR /app COPY . . +# Alpine patches ship fast. Upgrade base packages to pick up security fixes +# that landed after the pinned base image was published. +RUN apk upgrade --no-cache # Install the app itself (fast — all deps are already present) and grant # the Python binary cap_setgid so multi-user mode can call setgid(). diff --git a/Dockerfile.slim b/Dockerfile.slim index 062951a..7bc7ede 100644 --- a/Dockerfile.slim +++ b/Dockerfile.slim @@ -88,6 +88,10 @@ COPY --from=builder /install /usr/local WORKDIR /app COPY . . +# Uncomment to apply security patches beyond what the base image provides. +# Not recommended for reproducible builds; prefer bumping the base image tag. +# RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/* + # Install the app itself (fast — all deps are already present) and grant # the Python binary cap_setgid so multi-user mode can call setgid(). # ⚠️ setcap MUST run in the same layer as the binary to avoid overlay2 issues.